CVE-2026-65352: Apple iPadOS Information Disclosure Flaw

CVE-2026-65352 Overview

CVE-2026-65352 is an information disclosure vulnerability affecting multiple Apple operating systems. A website can determine a user's real IP address even when iCloud Private Relay is enabled. The flaw stems from improper state management within the affected Apple platforms and is categorized under [CWE-642: External Control of Critical State Data]. Apple addressed the issue with improved state management in iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 26.6.1.

Critical Impact
Attacker-controlled websites can deanonymize users who rely on Private Relay for network-level privacy, exposing their true IP address for tracking, geolocation, or targeted follow-on attacks.

Affected Products

Apple iOS (versions prior to 26.6.1)
Apple iPadOS (versions prior to 26.6.1)
Apple macOS Tahoe (versions prior to 26.6.2)
Apple visionOS (versions prior to 26.6.1)

Discovery Timeline

2026-09-14 - CVE-2026-65352 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-65352

Vulnerability Analysis

CVE-2026-65352 is an information disclosure flaw affecting the Private Relay privacy feature across Apple's operating systems. Private Relay routes user traffic through two separate internet relays so that no single party can associate a user's identity with the sites they visit. This vulnerability breaks that guarantee by allowing a website to observe the user's originating IP address despite Private Relay being active.

Apple's advisory attributes the fix to improved state management, indicating that the underlying networking or relay logic reached a state in which requests bypassed the intended relay path. The result is a leak of client-side network identity to remote web content.

The vulnerability requires user interaction, specifically visiting or loading resources from a malicious or attacker-influenced website. No authentication is required, and the attack is conducted entirely over the network.

Root Cause

The root cause is improper handling of internal state related to Private Relay routing decisions. Under specific conditions, the operating system exposes the true source IP address to the destination server rather than the anonymized relay egress address. This maps to CWE-642, where control-relevant state can be influenced or observed in a way the design did not intend.

Attack Vector

An attacker hosts a website or serves web content that triggers the state condition needed to disclose the user's IP address. When a Private Relay user loads the content, the site records the real client IP. The attacker gains reliable geolocation, ISP attribution, and a persistent tracking identifier that Private Relay was intended to hide.

No verified exploit code or public proof-of-concept is currently available for CVE-2026-65352. Refer to the Apple Support Article #148281 for vendor technical details.

Detection Methods for CVE-2026-65352

Indicators of Compromise

Web server access logs recording a client's ISP-assigned IP address for sessions where Private Relay headers or egress ranges were expected.
Fingerprinting scripts, tracking pixels, or WebRTC probes served from newly registered or low-reputation domains.
Requests from Apple devices whose HTTP metadata is inconsistent with Private Relay egress infrastructure.

Detection Strategies

Compare observed client source IPs against Apple's published Private Relay egress ranges to identify unexpected direct connections from users who should be relayed.
Inspect browser and network telemetry from managed Apple endpoints for requests to domains known to perform IP disclosure or deanonymization checks.
Correlate device OS build versions across the fleet to identify endpoints running vulnerable builds prior to iOS/iPadOS 26.6.1, macOS Tahoe 26.6.2, or visionOS 26.6.1.

Monitoring Recommendations

Track OS patch compliance for Apple endpoints and flag devices that remain on pre-patch builds.
Monitor outbound DNS and HTTP traffic for connections to fingerprinting or deanonymization services.
Alert on user-reported privacy anomalies such as location-based content appearing despite Private Relay being enabled.

How to Mitigate CVE-2026-65352

Immediate Actions Required

Update all Apple endpoints to iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, or visionOS 26.6.1 without delay.
Enforce update deployment through Mobile Device Management (MDM) policies for corporate-owned Apple devices.
Advise users who depend on Private Relay for privacy that their IP address may have been exposed on unpatched builds.

Patch Information

Apple released fixes in iOS 26.6.1, iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 26.6.1. See Apple Support Article #148281, Apple Support Article #148282, and Apple Support Article #148353 for the full advisories and version details.

Workarounds

Route sensitive browsing through a trusted VPN until affected devices are updated.
Disable Private Relay on unpatched devices to avoid a false sense of anonymity, and communicate this to users.
Restrict access to high-privacy workflows from vulnerable Apple OS builds via conditional access policies.

bash

# Verify installed OS build on macOS and confirm it is patched
sw_vers
# Expected on patched systems: ProductVersion 26.6.2 (macOS Tahoe) or later

# Verify installed iOS/iPadOS build
# Settings > General > About > Software Version
# Expected: 26.6.1 or later